https://kilatlabs.com/journal/ Sat, 26 Sep 2026 00:00:00 GMT Notes from the studio on Hyvä, Magento, Shopify Plus, Flutter, automation, motion and the craft of shipping premium digital products. en https://kilatlabs.com/journal/shopify-ai-toolkit-one-skill-vs-21-skills/ https://kilatlabs.com/journal/shopify-ai-toolkit-one-skill-vs-21-skills/ Sat, 26 Sep 2026 00:00:00 GMT Shopify merged 21 AI Toolkit skills into one router that picks the right API more reliably, but it sends prompts and code to Shopify by default. Opt out first. https://kilatlabs.com/journal/php-8-4-26-cves-streams-vs-curl-magento/ https://kilatlabs.com/journal/php-8-4-26-cves-streams-vs-curl-magento/ Fri, 25 Sep 2026 00:00:00 GMT Six of the eleven advisories in PHP 8.4.26 are triggered by the server your code calls, so Magento integrations built on streams need auditing, not curl ones. https://kilatlabs.com/journal/shopify-events-100-point-limit-split-vs-slim/ https://kilatlabs.com/journal/shopify-events-100-point-limit-split-vs-slim/ Thu, 24 Sep 2026 00:00:00 GMT Shopify Events now caps every subscription query at 100 points, down from 250, so fat product queries should be split into narrow ones per downstream system. https://kilatlabs.com/journal/nextjs-next-og-rce-cvss-9-5-vs-5-3/ https://kilatlabs.com/journal/nextjs-next-og-rce-cvss-9-5-vs-5-3/ Wed, 23 Sep 2026 00:00:00 GMT The same CVE that Next.js scores 9.5 critical is rated only 5.3 moderate upstream in Satori, so your dependency scanner will under-report the next/og RCE. https://kilatlabs.com/journal/shopify-automaticdiscounts-vs-discountnodes/ https://kilatlabs.com/journal/shopify-automaticdiscounts-vs-discountnodes/ Sat, 19 Sep 2026 00:00:00 GMT Shopify removes the automaticDiscounts query in API version 2027-01, and the obvious replacement, automaticDiscountNodes, is already deprecated as well. https://kilatlabs.com/journal/shopify-ui-extensions-64kb-cut-or-appeal/ https://kilatlabs.com/journal/shopify-ui-extensions-64kb-cut-or-appeal/ Fri, 18 Sep 2026 00:00:00 GMT Shopify now rejects any UI extension over 64 KB compressed at deploy, down from roughly 2 MB, and the exception form is an audit, not an escape hatch. https://kilatlabs.com/journal/shopify-events-2026-10-fields-changed/ https://kilatlabs.com/journal/shopify-events-2026-10-fields-changed/ Thu, 17 Sep 2026 00:00:00 GMT Shopify Events payloads changed on September 16 and every subscription must be on API version 2026-10 by October 1 or your next deploy ships the break. https://kilatlabs.com/journal/shopify-metafieldsset-flat-vs-dynamic-cost/ https://kilatlabs.com/journal/shopify-metafieldsset-flat-vs-dynamic-cost/ Wed, 16 Sep 2026 00:00:00 GMT Shopify's metafieldsSet mutation stopped costing a flat 10 points on September 15, and the same 25 metafields now cost 14 or 260 points depending on owners. https://kilatlabs.com/journal/shopify-discounts-allocator-vs-discount-api/ https://kilatlabs.com/journal/shopify-discounts-allocator-vs-discount-api/ Tue, 15 Sep 2026 00:00:00 GMT Shopify removed the Discounts Allocator Function API on September 10, and from September 29 any app still declaring its target fails its entire deploy. https://kilatlabs.com/journal/php-8-6-session-defaults-vs-magento-cookies/ https://kilatlabs.com/journal/php-8-6-session-defaults-vs-magento-cookies/ Mon, 14 Sep 2026 00:00:00 GMT PHP 8.6 beta 3 locked three session ini flips on September 10, and Magento storefronts already handle Lax, but every other PHP process on the box does not. https://kilatlabs.com/journal/shopify-cli-dev-stores-vs-magento-environments/ https://kilatlabs.com/journal/shopify-cli-dev-stores-vs-magento-environments/ Thu, 10 Sep 2026 00:00:00 GMT Shopify CLI 4.8 turns a dev store into a command capped at 250 per organization, while Adobe Commerce Cloud Pro still rations two integration branches. https://kilatlabs.com/journal/adobe-commerce-zero-day-apsb26-146-vs-138/ https://kilatlabs.com/journal/adobe-commerce-zero-day-apsb26-146-vs-138/ Wed, 09 Sep 2026 00:00:00 GMT CVE-2026-75650 scores a CVSS 10.0 and was exploited before Adobe's September 7 hotfix. Patching is step one of twelve, and a Hyvä frontend changes nothing. https://kilatlabs.com/journal/turbopack-chunking-vs-hyva-zero-bundle/ https://kilatlabs.com/journal/turbopack-chunking-vs-hyva-zero-bundle/ Fri, 04 Sep 2026 00:00:00 GMT Turbopack's chunking flags moved nextjs.org from 96 requests to 38, while a Hyvä storefront has no chunk graph to tune at all. Pick the tradeoff on purpose. https://kilatlabs.com/journal/shopify-pos-11-14-multiple-barcodes/ https://kilatlabs.com/journal/shopify-pos-11-14-multiple-barcodes/ Wed, 02 Sep 2026 00:00:00 GMT Shopify POS 11.14 finds a variant from any barcode attached to it, but the Admin API still documents one field. Audit your identifiers before you rely on it. https://kilatlabs.com/journal/polaris-cdn-semver-pinned-vs-stable/ https://kilatlabs.com/journal/polaris-cdn-semver-pinned-vs-stable/ Tue, 01 Sep 2026 00:00:00 GMT Shopify's Polaris CDN adopted semantic versioning on August 31, giving app teams a pinned production channel for the first time. Pin the minor, stage the RC. https://kilatlabs.com/journal/php-8-4-25-vs-8-5-10-magento-stacks/ https://kilatlabs.com/journal/php-8-4-25-vs-8-5-10-magento-stacks/ Fri, 28 Aug 2026 00:00:00 GMT PHP 8.4.25 and 8.5.10 shipped the same day with zero CVEs, but only one line keeps active support past December, and that gap decides your Magento plan. https://kilatlabs.com/journal/nodejs-24-20-lts-vs-26-8-current/ https://kilatlabs.com/journal/nodejs-24-20-lts-vs-26-8-current/ Thu, 27 Aug 2026 00:00:00 GMT Node.js shipped 24.20.0 LTS and 26.8.0 Current on the same day, and the LTS line got the far better release: audit mode and runtime permission dropping. https://kilatlabs.com/journal/nextjs-16-3-3-avif-rce-vs-windows-rce/ https://kilatlabs.com/journal/nextjs-16-3-3-avif-rce-vs-windows-rce/ Wed, 26 Aug 2026 00:00:00 GMT Next.js 16.3.3 patches two critical remote code execution bugs, and the AVIF one is the expensive fix because patching turns AVIF image optimization off. https://kilatlabs.com/journal/hyva-checkout-compatibility-official-vs-shim/ https://kilatlabs.com/journal/hyva-checkout-compatibility-official-vs-shim/ Tue, 25 Aug 2026 00:00:00 GMT Sendcloud's Hyva Checkout module is now officially maintained, which matters less for the feature list than for who absorbs the cost of the next upgrade. https://kilatlabs.com/journal/nextjs-august-2026-security-release-critical/ https://kilatlabs.com/journal/nextjs-august-2026-security-release-critical/ Fri, 21 Aug 2026 00:00:00 GMT Next.js pre-announced one critical vulnerability for August 26, so headless commerce teams now get six days to plan a patch window instead of scrambling. https://kilatlabs.com/journal/shopify-hydrogen-preview-vs-liquid-themes/ https://kilatlabs.com/journal/shopify-hydrogen-preview-vs-liquid-themes/ Thu, 20 Aug 2026 00:00:00 GMT Shopify's framework agnostic Hydrogen preview just paid down six items of headless tax, which changes when a premium brand should actually leave Liquid. https://kilatlabs.com/journal/nextjs-16-3-vs-hyva-app-like-storefronts/ https://kilatlabs.com/journal/nextjs-16-3-vs-hyva-app-like-storefronts/ Wed, 19 Aug 2026 00:00:00 GMT Next.js 16.3 brings Instant Navigations and View Transitions, closing the app-like gap with Hyvä, so the storefront choice is now ownership and not speed. https://kilatlabs.com/journal/flutter-3-47-standalone-ui-packages/ https://kilatlabs.com/journal/flutter-3-47-standalone-ui-packages/ Mon, 17 Aug 2026 00:00:00 GMT Flutter 3.47 ships material_ui and cupertino_ui as standalone 1.0 packages and makes Impeller the default renderer on desktop, so plan the iOS 15 bump. https://kilatlabs.com/journal/react-native-0-87-strict-typescript-api/ https://kilatlabs.com/journal/react-native-0-87-strict-typescript-api/ Fri, 14 Aug 2026 00:00:00 GMT React Native 0.87 makes the Strict TypeScript API the default and breaks deep imports, so upgrade now and fix them before 0.88 removes the escape hatch. https://kilatlabs.com/journal/php-8-6-beta-1-magento-hyva-stacks/ https://kilatlabs.com/journal/php-8-6-beta-1-magento-hyva-stacks/ Thu, 13 Aug 2026 00:00:00 GMT PHP 8.6 beta 1 landed August 13, 2026 with partial function application locked in, but no Magento line runs it yet, so keep storefronts on PHP 8.4 or 8.5. https://kilatlabs.com/journal/adobe-commerce-apsb26-92-security-patch/ https://kilatlabs.com/journal/adobe-commerce-apsb26-92-security-patch/ Wed, 12 Aug 2026 00:00:00 GMT Adobe's APSB26-92 patch, out August 11, 2026, is likely the last to cover Magento 2.4.5 and 2.4.6, so Open Source stores should apply it before upgrading. https://kilatlabs.com/journal/shopify-order-update-tax-recalculation-august-2026/ https://kilatlabs.com/journal/shopify-order-update-tax-recalculation-august-2026/ Fri, 07 Aug 2026 00:00:00 GMT Shopify's orderUpdate mutation starts recalculating taxes when a shipping address changes on August 31, 2026, so audit any custom order-edit flow now. https://kilatlabs.com/journal/shopify-checkout-extensibility-deadline-non-plus/ https://kilatlabs.com/journal/shopify-checkout-extensibility-deadline-non-plus/ Thu, 06 Aug 2026 00:00:00 GMT Non-Plus Shopify stores must move to checkout extensibility by August 26, 2026 or get auto-upgraded, stripping checkout.liquid and Additional Scripts edits. https://kilatlabs.com/journal/shopify-oxygen-development-stores-hydrogen/ https://kilatlabs.com/journal/shopify-oxygen-development-stores-hydrogen/ Wed, 05 Aug 2026 00:00:00 GMT Shopify now lets you deploy Hydrogen storefronts to Oxygen from free development stores as of August 3, 2026, so you can prototype headless before paying. https://kilatlabs.com/journal/magento-2-4-5-2-4-6-end-of-support-august-2026/ https://kilatlabs.com/journal/magento-2-4-5-2-4-6-end-of-support-august-2026/ Mon, 03 Aug 2026 00:00:00 GMT Magento 2.4.6 reaches end of standard support on August 11, 2026, and Open Source stores get no extended safety net, so plan your upgrade to 2.4.8 or 2.4.9 now. https://kilatlabs.com/journal/shopify-account-component-theme-store-requirement/ https://kilatlabs.com/journal/shopify-account-component-theme-store-requirement/ Sat, 01 Aug 2026 00:00:00 GMT Shopify now requires the shopify-account web component in every Theme Store theme as of July 30, 2026, retiring custom login templates and classic accounts. https://kilatlabs.com/journal/hyva-commerce-vs-enterprise-solstice-2026/ https://kilatlabs.com/journal/hyva-commerce-vs-enterprise-solstice-2026/ Fri, 31 Jul 2026 00:00:00 GMT Hyvä's Solstice release splits the suite: Hyvä Commerce for Magento Open Source and Mage-OS, Hyvä Enterprise for Adobe Commerce, plus a checkout on Magewire v3. https://kilatlabs.com/journal/node-js-july-2026-security-release-http2-permissions/ https://kilatlabs.com/journal/node-js-july-2026-security-release-http2-permissions/ Thu, 30 Jul 2026 00:00:00 GMT The Node.js July 2026 security release patches 11 CVEs across 26.x, 24.x and 22.x, and for a second month HTTP/2 and the Permission Model lead the list. https://kilatlabs.com/journal/nextjs-july-2026-security-middleware-bypass/ https://kilatlabs.com/journal/nextjs-july-2026-security-middleware-bypass/ Wed, 22 Jul 2026 00:00:00 GMT Next.js July 2026 security release patches a middleware auth bypass (CVE-2026-64642, CVSS 8.3) plus two SSRF flaws, so upgrade headless storefronts to 16.2.11. https://kilatlabs.com/journal/shopify-managed-markets-eu-returns-withdrawal/ https://kilatlabs.com/journal/shopify-managed-markets-eu-returns-withdrawal/ Fri, 17 Jul 2026 00:00:00 GMT Shopify Managed Markets now auto-handles the EU 14-day right of withdrawal from July 16 2026, so DTC brands selling into Europe face a merchant-of-record call. https://kilatlabs.com/journal/php-8-6-alpha-2-magento-hyva-stacks/ https://kilatlabs.com/journal/php-8-6-alpha-2-magento-hyva-stacks/ Thu, 16 Jul 2026 00:00:00 GMT PHP 8.6 alpha 2 landed July 16 2026 with clamp() and stricter core functions and a late-2026 stable target, so Magento and Hyva teams should test now. https://kilatlabs.com/journal/adobe-commerce-apsb26-73-security-patch/ https://kilatlabs.com/journal/adobe-commerce-apsb26-73-security-patch/ Wed, 15 Jul 2026 00:00:00 GMT Adobe Commerce security patch APSB26-73 lands July 14 2026 with 13 fixes, including two unauthenticated flaws, so Magento merchants should patch this week. https://kilatlabs.com/journal/shopify-customer-account-api-checkout-removed/ https://kilatlabs.com/journal/shopify-customer-account-api-checkout-removed/ Tue, 07 Jul 2026 00:00:00 GMT Shopify removes Customer.lastIncompleteCheckout and the Checkout type in API version 2026-10, so headless customer-account cart recovery needs a rebuild now. https://kilatlabs.com/journal/shopify-market-driven-shipping-markets-api/ https://kilatlabs.com/journal/shopify-market-driven-shipping-markets-api/ Fri, 03 Jul 2026 00:00:00 GMT Shopify market-driven shipping moves merchant shipping from delivery profiles into Markets and deprecates the legacy delivery profile APIs from August 2026. https://kilatlabs.com/journal/shopify-ucp-cart-mcp-agentic-commerce/ https://kilatlabs.com/journal/shopify-ucp-cart-mcp-agentic-commerce/ Fri, 26 Jun 2026 00:00:00 GMT Shopify is deprecating its Storefront MCP cart tools for UCP Cart MCP, with legacy tools live only until August 31, 2026, as agent checkout becomes the default. https://kilatlabs.com/journal/shopify-scripts-end-june-2026-functions/ https://kilatlabs.com/journal/shopify-scripts-end-june-2026-functions/ Tue, 23 Jun 2026 00:00:00 GMT Shopify Scripts stop working on June 30, 2026 with no extension, leaving Plus stores about a week to move discount, shipping and payment logic to Functions. https://kilatlabs.com/journal/node-js-june-2026-security-release-cve-triage/ https://kilatlabs.com/journal/node-js-june-2026-security-release-cve-triage/ Fri, 19 Jun 2026 00:00:00 GMT Node.js shipped twelve CVE fixes across 26.x, 24.x and 22.x on June 18, two of them high severity; here is what a headless commerce team should patch first. https://kilatlabs.com/journal/shopify-hydrogen-framework-agnostic-preview/ https://kilatlabs.com/journal/shopify-hydrogen-framework-agnostic-preview/ Thu, 18 Jun 2026 00:00:00 GMT Shopify is pulling Hydrogen's cart, product and money logic out of React Router into framework-agnostic primitives, so headless teams can pick any JS stack. https://kilatlabs.com/journal/shopify-metafield-definitions-customer-account-api/ https://kilatlabs.com/journal/shopify-metafield-definitions-customer-account-api/ Wed, 17 Jun 2026 00:00:00 GMT Shopify now hides app metafields from the Customer Account API unless they carry a definition, so headless storefronts that skipped the schema break silently. https://kilatlabs.com/journal/hyva-vs-luma-250-user-load-test/ https://kilatlabs.com/journal/hyva-vs-luma-250-user-load-test/ Wed, 10 Jun 2026 00:00:00 GMT A 250-user load test puts Hyvä at 5.2x faster than Luma on median response, but the p95 numbers tell a harder truth about uncached Magento under load. https://kilatlabs.com/journal/shopify-silent-sso-headless-checkout/ https://kilatlabs.com/journal/shopify-silent-sso-headless-checkout/ Tue, 09 Jun 2026 00:00:00 GMT Shopify just renamed the silent SSO parameter for headless checkout from logged_in=true to sso=silent. The shift signals where Customer Account API is heading. https://kilatlabs.com/journal/hyva-ai-search-doofinder-41-percent-ctr/ https://kilatlabs.com/journal/hyva-ai-search-doofinder-41-percent-ctr/ Mon, 08 Jun 2026 00:00:00 GMT A Hyvä storefront paired with a Doofinder AI assistant just shipped a 41 percent click-through rate from conversation to product. Here is why it matters. https://kilatlabs.com/journal/php-8-4-22-cves-magento-stacks/ https://kilatlabs.com/journal/php-8-4-22-cves-magento-stacks/ Fri, 05 Jun 2026 00:00:00 GMT PHP 8.4.22 and 8.5.7 just shipped ten CVE fixes, including a SOAP use-after-free and an FPM XSS. Magento 2.4.9 stacks need the rollout in production now. https://kilatlabs.com/journal/node-js-26-3-permission-drop-bff-hardening/ https://kilatlabs.com/journal/node-js-26-3-permission-drop-bff-hardening/ Thu, 04 Jun 2026 00:00:00 GMT Node.js 26.3.0 adds permission.drop(), httpValidation and a 64 KiB buffer pool. For headless commerce BFFs, the runtime finally hardens itself after boot. https://kilatlabs.com/journal/shopify-cart-view-key-optimistic-ui/ https://kilatlabs.com/journal/shopify-cart-view-key-optimistic-ui/ Wed, 03 Jun 2026 00:00:00 GMT Shopify just made cart view_key valid in cartLinesUpdate and cartLinesRemove. For headless Plus storefronts, the optimistic cart race condition is finally gone. https://kilatlabs.com/journal/mage-os-beat-shopify-data-ownership-pitch/ https://kilatlabs.com/journal/mage-os-beat-shopify-data-ownership-pitch/ Tue, 02 Jun 2026 00:00:00 GMT Mage-OS just published the pitch that won a 900-person German publisher back from Shopify. The argument: AI commoditises features, data ownership is the moat. https://kilatlabs.com/journal/what-ecommerce-automation-actually-costs-and-saves/ https://kilatlabs.com/journal/what-ecommerce-automation-actually-costs-and-saves/ Mon, 01 Jun 2026 00:00:00 GMT Automation is sold as a magic button. It is really a trade: engineering hours now against manual hours and errors forever. Here is how we scope that trade honestly. https://kilatlabs.com/journal/hyva-enterprise-all-inclusive-adobe-commerce/ https://kilatlabs.com/journal/hyva-enterprise-all-inclusive-adobe-commerce/ Mon, 01 Jun 2026 00:00:00 GMT Hyvä just relaunched Hyvä Enterprise as an All-Inclusive suite for Adobe Commerce. B2B, Sensei, Adobe EDS, gift cards and loyalty are bundled at €5,500. https://kilatlabs.com/journal/shopify-agents-md-llms-txt-liquid-templates/ https://kilatlabs.com/journal/shopify-agents-md-llms-txt-liquid-templates/ Fri, 29 May 2026 00:00:00 GMT Shopify just made agents.md, llms.txt and llms-full.txt overridable via Liquid templates. The brand voice your AI shopping agent hears is now yours to set. https://kilatlabs.com/journal/shopify-app-home-preact-ui-extension/ https://kilatlabs.com/journal/shopify-app-home-preact-ui-extension/ Thu, 28 May 2026 00:00:00 GMT Shopify just shipped App Home as a Preact admin UI extension. For studios building custom Plus apps, the iframe shell finally has a serious alternative now. https://kilatlabs.com/journal/magento-2-4-9-biggest-framework-jump-since-2-0/ https://kilatlabs.com/journal/magento-2-4-9-biggest-framework-jump-since-2-0/ Mon, 25 May 2026 00:00:00 GMT Magento 2.4.9 GA drops Laminas MVC, TinyMCE and PHP 8.2, lands Symfony 7.4 and native PHP OAuth. For Hyvä studios, this is the upgrade you cannot defer. https://kilatlabs.com/journal/flutter-3-44-unbundles-material-cupertino/ https://kilatlabs.com/journal/flutter-3-44-unbundles-material-cupertino/ Fri, 22 May 2026 00:00:00 GMT Flutter 3.44 pulls Material and Cupertino out of the core SDK into independently versioned packages. For mobile studios that means new dependency hygiene. https://kilatlabs.com/journal/shopify-next-gen-events-end-webhook-glue/ https://kilatlabs.com/journal/shopify-next-gen-events-end-webhook-glue/ Thu, 21 May 2026 00:00:00 GMT Shopify's Next Gen Events bring field-level triggers, GraphQL payloads and edge filters. The middleware tax on Plus integrations is finally going away. https://kilatlabs.com/journal/starting-a-journal/ https://kilatlabs.com/journal/starting-a-journal/ Wed, 20 May 2026 00:00:00 GMT A short note on what we plan to write about, and why the studio is making editorial work a first-class part of how we share what we build.